cronalert-mcp

MCP server for CronAlert uptime monitoring. Manage your monitors, check results, and incidents from Claude, Cursor, Windsurf, or any MCP-compatible AI client.

Quick Start

1. Get your API key

Sign up at cronalert.com and create an API key in Settings > API Keys.

When creating the key, choose a scope:

• Read-only — the agent can list and read monitors, check results, and incidents but cannot create, update, or delete anything. Recommended for most agent setups.
• Read & write — full access, including destructive tools. Optionally enable "require confirmation" so deletes need a server-issued confirmation token (see Security & permissions).

2. Add to your MCP client

Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "cronalert": {
      "command": "npx",
      "args": ["-y", "cronalert-mcp"],
      "env": {
        "CRONALERT_API_KEY": "ca_your_api_key_here"
      }
    }
  }
}

Claude Code — run:

claude mcp add cronalert -e CRONALERT_API_KEY=ca_your_key -- npx -y cronalert-mcp

Cursor — add to .cursor/mcp.json:

{
  "mcpServers": {
    "cronalert": {
      "command": "npx",
      "args": ["-y", "cronalert-mcp"],
      "env": {
        "CRONALERT_API_KEY": "ca_your_api_key_here"
      }
    }
  }
}

Remote server (no install needed) — connect any MCP client to:

https://cronalert.com/mcp

Authenticate with Authorization: Bearer ca_your_key header. Supports Streamable HTTP transport.

3. Start using it

Ask your AI assistant to manage your monitors (see examples below).

Available Tools

Security & permissions

Approvals in MCP clients are client-side: write tools carry destructiveHint: true, so Claude Code / Desktop / Cursor prompt before running them. CronAlert adds two server-side boundaries so the client prompt isn't the only gate:

• Read-only API keys. A read-only key is rejected on every write endpoint (create/update/delete/import) with a 403 — enforced by the server, regardless of the client. Hand agents a read-only key and destructive tools simply cannot succeed. This is the strongest boundary and the recommended default.
• Confirmation tokens for deletes. If a read-write key has "require confirmation" enabled, delete_monitor first returns a preview plus a short-lived, resource-bound confirmToken instead of deleting. The agent must call delete_monitor again with that token in the confirm argument. This prevents a single stray or prompt-injected call from destroying data and gives the server an auditable, explicit second step.

The API key is scoped to a single team, so the blast radius of any key is that team's resources.

Examples

Example 1: Create a monitor and check its status

User prompt: "Create a monitor for https://api.example.com/health that checks every minute, then show me its details."

What happens:

1. The AI calls create_monitor with name: "API Health", url: "https://api.example.com/health", checkInterval: 60
2. CronAlert creates the monitor and returns its ID
3. The AI calls get_monitor with the new ID to

... View full README on GitHub